CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

EUVD-2026-76687

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...

CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

CVE-2026-81909 Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...

Security Bulletin: IBM Sterling File Gateway is Vulnerable to Improper Access Control (CVE-2026-19290)

Summary IBM Sterling File Gateway has addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-19290 DESCRIPTION: IBM Sterling File Gateway could allow a remote attacker to obtain sensitive information due to improper access control. CWE:CWE-284: Improper Access Control CVSS...

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The vulnerability in question is CVE-2026-85706 CVSS score: 10.0, a path traversal issue in the repository commits AP...

Exploit for CVE-2026-85706

cve-2026-85706 Unauthenticated arbitrary local file read in G...

PT-2026-89804

Patch CVE-2026-16338 immediately. Learn how this 9.9 CVSS flaw allows arbitrary file write attacks in IBM DataStage and how to secure your data today. CVE202616338 IBMDataStage CyberSecurity InfoSec ArbitraryFileWrite CloudSecurity Vulnerability https://t.co/k9OgrO33Vv https://t.co/lVFSA4z6H7...

Linux Distros Unpatched Vulnerability : CVE-2026-46352

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to...

PT-2026-90498

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

Security Bulletin: IBM MQ Appliance is affected by an improper authorization vulnerability (CVE-2026-10030)

Summary IBM MQ Appliance has addressed an improper authorization vulnerability that could allow an authenticated attacker to create and start queue managers. Vulnerability Details CVEID:CVE-2026-10030 DESCRIPTION: IBM MQ Console allows authenticated non-administrative users to create and start...

Security Bulletin: IBM MQ Appliance is affected by a heap buffer overflow vulnerability (CVE-2026-11381)

Summary IBM MQ Appliance has addressed a heap buffer overflow vulnerability. Vulnerability Details CVEID:CVE-2026-11381 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution...

Joomla! Webservice - Password Disclosure

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. id: CVE-2023-23752 info: name: Joomla! Webservice - Password Disclosure author: badboycxcc,Sascha Brendel severity: medium description: | An issue was discovered in...

Fedora 44 : darktable (2026-2719c6cac1)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2719c6cac1 advisory. 5.6.1 release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-022374)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022374 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.29 and prior. Easily exploitable...

Exploit for CVE-2026-74586

CVE-2026-74586 — SCTP ASCONF newtransport use-after-free trig...

Vulnerabilities found in Fortinet’s Forti-products

Fortinet has identified vulnerabilities in FortiAnalyzer, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiManager, FortiManager Cloud, FortiMonitorOnSight, FortiClient Windows, FortiSIEM, and FortiSOAR. These vulnerabilities involve various types of errors in multiple Fortinet products. The mos...

SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport EPP Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 CVSS...

ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

Security Advisory 0158

Security Advisory 0158 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added Description Both CVE-2026-73456 and CVE-2026-73457 affect Arista EOS-based platforms with gRPC Network Packet...